The World's Big AI-Safety Report Said Autonomous Cyberattacks Aren't Here 'Yet.' The 'Yet' Is Expiring Faster Than the Report Can Be Updated.
In February, 100+ experts from 30+ countries, chaired by Yoshua Bengio, published the closest thing to a scientific consensus on AI risk. Its careful cyber judgment: AI already automates *most* of an attack and runs *some* steps autonomously, but no fully end-to-end autonomous attack has been reported — 'not yet.' Five months on, that 'yet' is under visible strain from developments the report predates (autonomous zero-day models, a real government breach). The real story isn't the cyber finding; it's that you can't govern a months-fast capability curve with a once-a-year consensus document. Also: contrary to the framing going around, China participated — Russia is the absentee.
In February, more than 100 experts from over 30 countries, chaired by Yoshua Bengio — one of the handful of people who built modern AI — published the closest thing the world has to a scientific consensus on AI risk. On cyberattacks, its central judgment was a carefully hedged "not yet": AI helps criminals and states scale their attacks, it can already run some attack steps on its own, and in one documented case it automated most of an attack — but nobody had reported a fully autonomous, end-to-end AI cyberattack. Five months later, that "not yet" is the most revealing phrase in the whole document, because it's expiring in real time, and what that says about governing AI matters more than anything in the report itself.
Here's the frame, and it's not a knock on the panel: the report is careful, authoritative, and already out of date, and those three things are not in tension. The problem isn't the experts. It's the instrument. You cannot govern a capability curve measured in months with a consensus document that ships once a year. The most authoritative AI-risk baseline on Earth was arguably obsolete before its own findings finished circulating — and that is the actual warning, not the cyber finding.
Start by noticing that the reassuring headline undersells the report's own words. "AI can't run cyberattacks autonomously yet" sounds like comfort. What the report actually says is that AI already carries out some attack tasks autonomously and, in one documented incident, automated most of the work of an attack — with only fully end-to-end automation still unreported. (That "one incident at a major AI company" is almost certainly the Anthropic-documented Claude cyber-abuse case.) The distance between "does most of an attack by itself" and "does all of it" is thin, and it is the entire load-bearing gap in the reassuring version.
Now put the February baseline against the spring that followed it. The report predates two things that press directly on its "not yet." Anthropic's Mythos 5 is a model built to discover zero-day vulnerabilities autonomously, at machine speed — the US government redeployed it to defenders specifically because of that capability. And the Mexican government breach became a real-world confirmation of the report's own caveat that "sophisticated attackers can often bypass current defenses." A February "not yet," measured against a spring that produced an autonomous zero-day discovery model and an actual state breach, is a "not yet" visibly under strain. The gap the report flagged as still-open may have quietly closed while the PDF sat unchanged.
One correction, because the version circulating gets it backwards: China participated in this report, alongside the EU, the UK, Germany, and Japan. The "two other major AI powers are absent" framing is wrong — Russia is the plausible absentee, not China. That's not a footnote. The report's quietest achievement is a shared factual baseline that includes China, which in 2026 is rarer and more fragile than any single finding in it. But a shared baseline that runs a year stale is a baseline nobody can actually act on in time — the multilateral tent is real and the clock inside it is wrong.
So the thing to watch isn't this edition; it's the 2027 one, and specifically whether "fully autonomous end-to-end attacks not yet reported" flips to "reported." Mythos-class capability and the Mexico breach suggest it well might — and if it does, the annual-consensus model will have documented the threshold crossing roughly a year after it happened. My read is that the report is genuinely valuable as a baseline to measure escalation against and genuinely inadequate as a governance instrument, because the thing it governs moves faster than it can publish. What would change that is structural, not editorial: a standing body that refreshes the consensus in months, not years. Until one exists, the most careful phrase in AI governance is "not yet," and the quiet tragedy of a once-a-year report is that by the time it prints "yet," you're not reading a warning. You're reading history.